CN114257433A

CN114257433A - Ethernet channel gate

Info

Publication number: CN114257433A
Application number: CN202111527117.1A
Authority: CN
Inventors: 不公告发明人
Original assignee: Guo Aibo
Current assignee: Guo Aibo
Priority date: 2019-07-05
Filing date: 2019-07-05
Publication date: 2022-03-29
Also published as: CN110365669A

Abstract

The Ethernet channel gate (C1 in figure 3) of the present invention is composed of an Ethernet channel and a one-way gate, and separates the gates in two directions in a common network gate, wherein the right gate moves to the left, and the left gate moves to the right, so as to form two mutually independent and symmetrical one-way gates. The unidirectional gate in C1 appears only on the outward path of the a node and the inward path of the B node, the other path in the opposite direction goes directly through C1 without any electrical connection to the unidirectional gate, and the nodes no longer exist, i.e.: c1 does not constitute nor contain a network node, and C1 has neither a MAC address nor any protocol address and cannot be directly accessed. The C1 has no bidirectional communication capability with any node on both sides, the necessary condition that the C1 can be broken is no longer satisfied, the node on the B side cannot perform any control on the C1, and the node on the a side can only perform open-loop control on the C1 at most, so that the self safety is increased suddenly. Can be used singly or in pairs to form a system which can not be broken or is difficult to be broken.

Description

Ethernet channel gate

The application is a divisional application, and the original application information is as follows:

application date: year 2019, month 07, day 05

Application No.: 201910603098.2

The invention creates the name: unidirectional Ethernet gate

One, the technical field

The invention belongs to the field of computer network and information security, and particularly relates to the special field of security isolation of a network, reliable data transmission and self security of network security equipment.

Second, background Art

With the emphasis on network and information security, more and more network and information security products appear on the market, and no matter the products appear in a pure software mode or a mode of combining software and hardware, the products face a common pain point under the severe situation of one rule at high height and one magic height: this is the security of the security product itself. When a network and information security product is broken, all the declared security protection functions are changed into 'Uyou'.

Safe isolation and reliable transmission are two conflicting concepts, the safest isolation being too physically disconnected, i.e. there is no connection between the two nodes A, B, in which case there is no possibility of any transmission between A, B; reliable transmission is usually achieved by two-way communication even if the transmission itself is unidirectional, since feedback is needed to achieve reliable transmission, but isolation between A, B is problematic.

Third, the invention

The invention aims to solve the technical problem of how to realize the safety of isolation and the reliability of transmission and overcome the potential safety hazard of the existing network safety equipment. When we install A, B a common gatekeeper between two nodes, it forms a new network node C, which not only has a physical address such as MAC (two-layer network node feature), but also is often configured with a protocol address such as IP (three-layer network node feature), and the user can also directly access it through MAC/IP address. It is called a "gatekeeper" because it filters/relays network traffic, like a "gate," as shown by the dashed lines in fig. 1. It is known that, within node C, there are two gates at the same time: one is a gate for receiving upper left and lower right transmission (called right gate for short), and the other is a gate for receiving upper right and lower left transmission (called left gate for short). C has two ports (ports), C maintains full bidirectional communication capability with a through the port on the left, C also maintains full bidirectional communication capability with B through the port on the right, so a and B both have full bidirectional communication capability with C, which is a necessary condition for C to be able to break. The invention separates the two directional gates in C, the right gate moves to the left, the left gate moves to the right, and two independent and symmetrical one-way gates C1 and C2 are formed, as shown in figure 2. We only discuss C1, as shown in fig. 3, it can be seen from fig. 3 that the unidirectional gate in C1 only appears on the outward path of the a node and the inward path of the B node, and the other path in the opposite direction directly passes through C1 without any electrical connection with the unidirectional gate, so that the originally symmetrical path presents an asymmetrical structure in C1, and the node no longer exists, that is: c1 does not constitute nor contain a network node, and C1 has neither a MAC address nor any protocol address and cannot be directly accessed. The C1 has no bidirectional communication capability with any node on both sides, the necessary condition that the C1 can be broken is no longer satisfied, the node on the B side cannot perform any control on the C1, and the node on the a side can only perform open-loop control on the C1 at most, so that the safety of the gate itself rises suddenly. In practical application, on one hand, a key, a common switch or a DIP dial switch can be arranged in an ethernet channel gate to set and adjust the functions of the ethernet channel gate, so that the ethernet channel gate is suitable for different safety requirements, is convenient to use, and particularly changes the filtering function into full filtering, namely discards all packets to form a (logic) unidirectional ethernet bridge or changes the filtering function into full cancellation, namely all packets pass through to form a (bidirectional) ethernet bridge; on the other hand, the ethernet channel gate can be used alone, as shown in fig. 4, or can be used in pairs by connecting the crossed network cables in reverse and in series, as shown in fig. 5, to form a system that is not or difficult to be breached, and it should be noted that: in the scenario shown in fig. 4, if the PC1 and the router are removed, the system formed by the PC2 and the PC3 is not substantially different from that shown in fig. 5, but two ethernet channel gates are connected together through a switch.

The present invention does not relate to layer two network technologies other than ethernet, and 100BASE-TX is used herein for descriptive convenience only, and other forms of ethernet may be used in practice.

Description of the drawings

Fig. 1 is a structure diagram of a "gate" of a common gatekeeper in a 100BASE-TX ethernet environment, in which C integrates a bidirectional filtering function and has bidirectional communication capability with both ends a and B.

Fig. 2 is a schematic diagram of the ethernet gateway of the present invention in a 100BASE-TX ethernet environment, in which C1 and C2 are identical, and both perform filtering in only one direction when two directions originally exist, and this structure makes the present invention substantially different from the prior art.

FIG. 3 is a diagram of the internal structure of the Ethernet channel gate C1 and its connection relationship with the nodes A, B at both ends in the 100BASE-TX Ethernet environment, where the channel from B to A only passes through C1 and has no electrical connection with the one-way gate in C1; the number in parentheses in fig. 1, 2 and 3 is the pin number of the twisted pair in the corresponding RJ45 socket in a 100BASE-TX ethernet environment.

Fig. 4 is an application scenario diagram of the ethernet gateway of the present invention used alone.

Fig. 5 is a diagram of an application scenario in which an ethernet gateway employs cross-over network lines in pairs, where attention is paid to: the two single use scenarios of fig. 4 may also result in the pair-wise use effect shown in fig. 5. The 100BASE-TX is mentioned in the figures for descriptive convenience only, and other forms of ethernet may be used in practice. ECGx (Ethernet Channel Gate, x is a numerical value) in fig. 4 and 5 represents the Ethernet Channel Gate of the present invention. In fig. 4, the ethernet channel gate is not installed in the PC1, and the ethernet channel gates are installed between the PC2, the PC3 and the SWITCH. Still taking 100BASE-TX ethernet as an example for explanation, in the connection of PC1, PC1 is connected to SWITCH via a straight-through (straight-through) network line, in which there exists both a PC1 → SWITCH channel (1, 2 pairs of lines) and a SWITCH → PC1 channel (3, 6 pairs of lines), so that PC1 can transmit packets to SWITCH, SWITCH and PC 1. In the connection of the PC2, physical connection of an ethernet gateway is shown, and it can be seen that the connection mode of the ethernet gateway is completely the same as that of network devices such as firewalls; in the connection of PC3, we further show the logical connection of the ethernet channel gate. It can be seen that the ethernet channel gate is connected to the outbound channel of PCx (x is a numerical value), and the basic principle is to selectively relay the outbound frame (frame), and the ethernet channel gate can have parameters such as access control list, and keys, normal switches or DIP switches inside.

Fifth, detailed description of the invention

The specific implementation mode is shown in the attached figures 4 and 5. Fig. 4 is a scenario in which the ethernet gateway is used alone, and fig. 5 is a scenario in which the ethernet gateway is used in pair, and either alone or in pair is completed by using an IP protocol whose protocol is 1 when access control is required to be performed on the ethernet gateway.

Claims

1. An ethernet channel gate (C1 in fig. 3) comprising an ethernet channel and a unidirectional gate, characterized in that: (1) the unidirectional gate is arranged on one channel of the Ethernet, and the other channel in the opposite direction directly passes through the gate (C1 in figure 3) without any electric connection with the unidirectional gate, so that the originally symmetrical channel presents an asymmetrical structure in the gate (C1 in figure 3); (2) the network node is not formed, the network node is not included, the network node and any nodes on two sides do not have bidirectional communication capability, the necessary condition that the network node can be broken is not satisfied, the node (B in the figure 3) on one side can not carry out any control on the brake (C1 in the figure 3), the node (A in the figure 3) on the other side can only carry out open-loop control on the brake (C1 in the figure 3) at most, and the self safety is increased suddenly.

2. The ethernet channel gate of claim 1, wherein the functions are selectively set and adjusted by a button, a normal switch or a DIP dial switch.

3. Changing the filtering function of the ethernet tunnel gate of claim 1 to full filtering, i.e. discarding all packets, forming a (logical) unidirectional ethernet bridge.

4. Two ethernet channel gates according to claim 1 are connected in reverse by means of cross-wires or switches to form a (bi-directional) ethernet gate with filtering in both directions.